Skip to content

Update all dependencies - #1120

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all
Open

Update all dependencies#1120
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all

Conversation

@renovate

@renovate renovate Bot commented Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Confidence
actions/checkout action patch v7.0.0 → v7.0.1 age confidence
github/codeql-action action minor v3.36.3 → v3.37.6 age confidence
yarn (source) packageManager minor 4.17.0 → 4.18.0 age confidence
org.junit.jupiter:junit-jupiter (source) dependencies patch 6.1.1 → 6.1.2 age confidence
com.fasterxml.jackson.core:jackson-core dependencies minor 2.21.5 → 2.22.1 age confidence
com.fasterxml.jackson.core:jackson-databind (source) dependencies minor 2.21.5 → 2.22.1 age confidence
tools.jackson.core:jackson-core dependencies minor 3.1.1 → 3.2.1 age confidence
tools.jackson.core:jackson-databind (source) dependencies patch 3.1.4 → 3.1.5 age confidence
io.netty:netty-codec (source) dependencies patch 4.2.16.Final → 4.2.17.Final age confidence
com.squareup.okio:okio dependencies minor 3.17.0 → 3.18.1 age confidence
io.netty:netty-handler (source) dependencies patch 4.2.15.Final → 4.2.17.Final age confidence
io.netty:netty-handler-proxy (source) dependencies patch 4.2.16.Final → 4.2.17.Final age confidence
io.netty:netty-codec-socks (source) dependencies patch 4.2.16.Final → 4.2.17.Final age confidence
io.opentelemetry:opentelemetry-api dependencies minor 1.63.0 → 1.64.0 age confidence
org.apache.httpcomponents.client5:httpclient5 (source) dependencies patch 5.6.2 → 5.6.3 age confidence
org.jetbrains.kotlin.jvm (source) plugin minor 2.3.21 → 2.4.10 age confidence
com.gradleup.shadow plugin minor 9.2.0 → 9.6.1 age confidence

jackson-databind: @​JsonView bypassed for @​JsonUnwrapped container properties on deserialization

CVE-2026-59889 / GHSA-5gvw-p9qm-jgwh

More information

Details

Summary

UnwrappedPropertyHandler.processUnwrapped() replays the buffered JSON for a @JsonUnwrapped property by iterating its properties and calling prop.deserializeAndSet() with no prop.visibleInView(ctxt.getActiveView()) guard — the exact guard processUnwrappedCreatorProperties() received in the #​5971 / GHSA-rcqc-6cw3-h962 fix, and the guard BeanDeserializer.deserializeWithUnwrapped applies to directly-matched properties. As a result, a property annotated with both @JsonView(PrivilegedView.class) and @JsonUnwrapped is written from attacker JSON even when deserializing under a more-restrictive active view.

Correction to the original framing (runtime-verified): the gap is NOT a per-field inner @JsonView (the unwrapped sub-object's own BeanDeserializer gates inner fields correctly). The unchecked gate is the view of the unwrapped CONTAINER property.

Intent proof (runtime, 2.x HEAD 21dd70dd and 3.x HEAD 7a5939d6)

An @JsonView(AdminView) property that is NOT @JsonUnwrapped → null under PublicView (correctly gated). The identical property WITH @JsonUnwrapped → fully populated (bypass). The fix the creator path already received, not applied to the regular-property method.

Impact — write-side mass-assignment / privilege escalation

@JsonView is commonly used as a write-side authorization guard: a public endpoint binds the body under readerWithView(PublicView.class) and groups privileged state in a nested object whose container property is @JsonView(AdminView). When that property is @JsonUnwrapped, an untrusted caller mass-assigns it. PoC: a self-service registration where AccountFlags{role,approved,creditBalance} is @JsonView(AdminView) @JsonUnwrapped; attacker JSON {role:ADMIN,approved:true,creditBalance:1000000} under PublicView binds all three → approved admin with arbitrary balance. The failing gate is a WRITE gate, hence integrity-high (C:N/I:H/A:N); no worse than the C:L/I:L parent and arguably higher as @JsonView-as-write-guard is the exact use case #​5971/#​5969 defended.

Affected
  • com.fasterxml.jackson.core:jackson-databind 2.x: confirmed bypass at 21dd70dd (== released 2.21.4 / 2.22.0 line; includes the #​5973 backport). DEFAULT_VIEW_INCLUSION default=true.
  • tools.jackson.core:jackson-databind 3.x: confirmed bypass at HEAD 7a5939d6 (latest 3.x). DEFAULT_VIEW_INCLUSION default=false → the stock-config repro is the common shape where privileged inner fields are individually @JsonView(PublicView) and the developer relies on the container @JsonView(AdminView); the 3.x PoC mass-assigns role/approved/creditBalance under PublicView. (The other simultaneous report's PoC was reportedly fixed on 3.x; this distinct container-property path is not.)
Additive variants (runtime-confirmed both branches; all closed by the same one-line guard)
  • nested @JsonUnwrapped (unwrapped-in-unwrapped) — recursive bypass.
  • merge / readerWithView(...).withValueToUpdate(...) (PATCH/partial-update) — bypass; non-unwrapped merge control gates correctly.
  • builder-based deserializer (@JsonDeserialize(builder=...)) — BuilderBasedDeserializer routes through the same processUnwrapped.
  • Honest non-findings: read-side serialization correctly honors views (no leak); @JsonAnySetter+view and @JsonTypeInfo+@JsonUnwrapped are separate/unsupported behaviors, not this bug.
Fix

Add prop.visibleInView(ctxt.getActiveView()) (when MapperFeature.DEFAULT_VIEW_INCLUSION/active-view applies) to the processUnwrapped() property loop, mirroring processUnwrappedCreatorProperties(). One change closes the impact PoC + all three variants across BeanDeserializer and BuilderBasedDeserializer. Full runnable PoCs (2.x + 3.x) + variant harnesses available on request.

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

actions/checkout (actions/checkout)

v7.0.1

Compare Source

github/codeql-action (github/codeql-action)

v3.37.6

Compare Source

  • Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #​4070

v3.37.5

Compare Source

v3.37.4

Compare Source

  • This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #​4037
  • Update default CodeQL bundle version to 2.26.2. #​4051

v3.37.3

Compare Source

No user facing changes.

v3.37.2

Compare Source

  • The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #​4023
  • The CodeQL Action can now make use of configured private registries in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. #​4007

v3.37.1

Compare Source

  • Upcoming breaking change: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. #​3956
  • Update default CodeQL bundle version to 2.26.1. #​4019

v3.37.0

Compare Source

yarnpkg/berry (yarn)

v4.18.0: v4.18.0

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/yarnpkg/berry/compare/@yarnpkg/cli/4.17.1...@​yarnpkg/cli/4.18.0

v4.17.1: v4.17.1

Compare Source

What's Changed

New Contributors

Full Changelog: https://github.com/yarnpkg/berry/compare/@yarnpkg/cli/4.17.0...@​yarnpkg/cli/4.17.1

junit-team/junit-framework (org.junit.jupiter:junit-jupiter)

v6.1.2

lysine-dev/okio (com.squareup.okio:okio)

v3.18.1

2026-07-28

  • Fix: Restore binary-compatibility with Okio 3.17.x for Kotlin/Native users. When we introduced
    the new base64() function, we inadvertently changed the binary signature! Ugh! This is now
    fixed and we've automated binary-compatibility checking for Kotlin/Native going forward.

v3.18.0

2026-07-21

  • Fix: Use wide character APIs to better support of non-UTF-8 filesystems on Windows.
  • Fix: Don't crash in AssetFileSystem.exists() when the underlying storage throws a
    FileNotFoundException.
  • Fix: Load WASI paths relative to their preopen. The platform behavior recently changed in
    NodeJS, causing our WasiFileSystem to be unable to access files!
  • New: Optionally ignore whitespace when decoding hexadecimal.
  • New: Optionally omit padding when encoding Base64.
  • New: BufferedSource.readUInt(), BufferedSink.writeUInt(), and similar functions for UByte,
    UShort and ULong. Also add support for unsigned and little-endian.
  • New: BufferedSink.utf8Appendable(). Use this to adapt an Okio sink to an Appendable.
  • New: Source.limit() returns a wrapped source with a strict limit on how many bytes are
    returned.
  • New: ByteString.equals(other, constantTime) for subtle defense against timing attacks.
open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-api)

v1.64.0

API
  • Fix W3CBaggagePropagator to allow empty baggage values per W3C spec
    (#​8468)
  • Fix baggage parsing for invalid percent-encoded members
    (#​8480)
Incubating
  • BREAKING Remove deprecated InstrumentationConfigUtil.peerServiceMapping
    (#​8542)
  • Fix EnvironmentGetter/EnvironmentSetter to not enumerate or normalize carrier entries, and
    normalize empty names consistently
    (#​8474,
    #​8481)
SDK
Traces
  • Add BatchSpanProcessor.create(SpanExporter) convenience factory to mirror
    SimpleSpanProcessor.create(SpanExporter)
    (#​8564)
  • Fix BatchSpanProcessor benchmark aux counters (exportedSpans/droppedSpans) always
    reporting zero
    (#​8539)
Metrics
  • Fix PooledHashMap dropping live entries when an entry is removed during forEach
    (#​8499)
  • Safely initialize exemplar reservoir storage in FixedSizeExemplarReservoir
    (#​8524)
  • Use failExceptionally in PeriodicMetricReader when the exporter is busy
    (#​8525)
  • Only set valuesRecorded in AggregatorHandle when false
    (#​8559)
  • Use volatile instead of atomics in Double/LongLastValueAggregator
    (#​8560)
  • Randomize per-thread recording order in metric benchmarks to avoid concurrency hotspots
    (#​8550)
Logs
  • Fix BatchLogRecordProcessor worker thread being killed by non-runtime exceptions
    (#​8529)
Exporters
  • BREAKING Prometheus: Drop deprecated PrometheusMetricReader constructors
    (#​8541)
  • OTLP: Reject host-less endpoints in EndpointUtil.validateEndpoint
    (#​8489)
  • OTLP: Replace Jackson OTLP JSON serialization with a hand-rolled implementation
    (#​8545)
  • OTLP Profiles: Fix OtlpGrpcProfileExporter toString class name
    (#​8492)
  • Prometheus: Add translation strategy support
    (#​8346)
  • Prometheus: Fix serialization of array-valued scope and resource attributes to JSON strings
    (#​8497)
Extensions
  • BREAKING Declarative config: Move experimental types to internal package
    (#​8530)
  • Declarative config: Commit generated schema POJOs to git
    (#​8408)
  • Declarative config: Update to opentelemetry-configuration v1.1.0
    (#​8451)
  • Declarative config: Adjust POJO toString/hashCode/equals to match AutoValue semantics
    (#​8526)
  • Declarative config: Add ref descriptions to generated model classes
    (#​8540)
  • Declarative config: Emit consistent @JsonProperty annotations on generated models
    (#​8563)
  • Declarative config: Remove duplicate resolver in DeclarativeConfigPropertyUtil
    (#​8579)
Project tooling
  • Add configuration policy guidance
    (#​8429)
  • Exclude certain GitHub Actions from running on forks
    (#​8466)
  • Add guidance to prefer parameterized tests
    (#​8469)
  • Make benchmark path configurable
    (#​8557)
apache/httpcomponents-client (org.apache.httpcomponents.client5:httpclient5)

v5.6.3

JetBrains/kotlin (org.jetbrains.kotlin.jvm)

v2.4.10: Kotlin 2.4.10

Changelog

Backend. Wasm
  • KT-87066 K/Wasm: Not all files are presented in compiler output directory with multimodule-closed-world and incremental compilation
Compiler
  • KT-86939 JVM: IllegalStateException "No value for annotation parameter" when using const val in nested Java annotation array argument
  • KT-83766 K2: Wrong sourcePsi is set for SymbolPsiLiteral in SLC for annotation arguments referencing a const val
  • KT-86728 Reified type inference: expected type not propagated into inline call inside lambda with elvis operator
Compose Compiler
  • b/522127447 Compose Compiler 2.4: classes previously inferred stable now reported runtime/Uncertain
Klibs
  • KT-86501 Native: IrTypeAliasSymbolImpl is already bound. Signature: kotlinx.datetime/Instant|null[0] on iosSimulatorArm64
Tools. CLI
  • KT-86930 Introduce kotlinr in the Kotlin distribution
Tools. Gradle. BCV
  • KT-87223 Gradle, BCV: open version range in kotlinAbiValidationCompatClasspath causes kotlin-build-tools-impl to resolve to 2.4.20-Beta1 instead of 2.4.0
Tools. Gradle. JS
  • KT-87304 jsBrowserTest fails with "exited with errors (exit code: 1)"
  • KT-86057 kotlinUpgradeYarnLock skips lock file regeneration when kotlinNpmInstall is up-to-date, causing kotlinStoreYarnLock to fail
Tools. Gradle. Multiplatform
  • KT-87084 False positive warning for JS and Wasm compilations when CRI is enabled
Tools. Scripts
  • KT-87076 @file:CompilerOptions("-jvm-target", ...) ignored in .main.kts scripts in Kotlin 2.4.0, falling back to JVM target 1.8
  • KT-86352 K2 scripting: FirResolvedTypeRef exception when resolving extension functions from imported scripts

v2.4.0: Kotlin 2.4.0

Changelog

Analysis API
  • KT-83867 OVERLOAD_RESOLUTION_AMBIGUITY false positive with assertEquals in IJ repo
  • KT-83723 [Analysis API] Enable experimental KDoc resolver by default
  • KT-83388 Analysis API: properly support KMP in KotlinPackageProvider
  • KT-65683 Analysis API: Dangling file session creation causes a computeIfAbsent contract violation
Analysis API. Code Compilation
  • KT-78946 Evaluation of variable with local class in type parameter leads to InventNamesForLocalClasses exception
Analysis API. FIR
  • KT-68260 K2 AA: InvalidFirElementTypeException “For CALLABLE_REFERENCE_EXPRESSION with text ::lam1, unexpected element of type: no element found” with illegal callable reference call
  • KT-70896 AA: False positive deprecation warning with override of built-in method in JDK mapped class
  • KT-84711 K2 IDE sometimes loses FIR plugin-generated declarations after file changes
  • KT-84625 Analysis API: collectDesignationPath fails for nested classes inside plugin-generated top-level classes
  • KT-84596 Improve K2 Jooq completion performance
  • KT-84525 KaValueParameterSymbol#getHasSynthesizedName returns false for FirDeclarationOrigin.SubstitutionOverride.DeclarationSite
  • KT-83546 Kotlin analysis reach ClsCustomNavigationPolicy
  • KT-84259 Move CommonDefaultImportsProvider to the frontend independent module
  • KT-82945 Analysis API: KotlinIllegalArgumentExceptionWithAttachments: Expected FirResolvedTypeRef with ConeKotlinType but was FirUserTypeRefImpl
  • KT-71135 AA: exception from sealed inheritors checker when analyzeCopy
Analysis API. Infrastructure
Fixes
  • KT-83905 Analysis API: Improve UX with test data
  • KT-84913 Extract compiler classes used by the PSI & Analysis API to a separate module
  • KT-64986 Analysis API: Implement Analysis API tests for different KMP Platforms
  • KT-84776 The test data manager misses the redundancy check in the update mode
  • KT-84962 The test data manager misses -ea flag
  • KT-84388 Preserve the EOF status in the test data manager to avoid extra changes
  • KT-84362 Analysis API tests produce many warnings due to "not yet loaded registry"
  • KT-84279 Test Data Manager fails on a clean build
  • KT-83913 Exclude compiler-based Analysis API tests from Git tracking
  • KT-80379 Extract per-module test generators for AA tests
  • KT-84120 Move CLI modules out of kotlin-compiler-fe10-for-ide
  • KT-83200 Track external dependencies of the Analysis API modules
Analysis API. Light Classes
  • KT-82434 Light classes should prefer enum entries to properties
  • KT-84200 SLC: return type is not boxed for delegated methods with generic original method
  • KT-72451 "CCE: class PsiPrimitiveType cannot be cast to class PsiClassType" with same-named enum class and typealias
Analysis API. PSI
  • KT-84715 removeModifier doesn't delete whitespaces around the removed modifier
  • KT-84564 KtEnumEntry.delete deletes semicolon
  • KT-84781 Use computed properties in KotlinElementTypeProviderImpl
  • KT-83846 Set up guidelines for PSI
  • KT-84135 Deprecate KtSelfType
Analysis API. Providers and Caches
  • KT-82731 Analysis API: Limit granular tree change processing to a few files
  • KT-79234 Analysis API: Usage of asMap() on Caffeine caches bypasses stats counters
  • KT-74090 Analysis API: Support dumb mode (restricted analysis)
Analysis API. Standalone
  • KT-83801 Nested typealiases are not correctly indexed in standalone mode
Analysis API. Stubs and Decompilation
  • KT-85371 StackOverflowError from LLKotlinStubBasedLibrarySymbolProvider and StubBasedClassDeserialization
  • KT-83935 Support KDoc loading in decompiled stubs
Analysis API. Surface
New Features
  • KT-85239 Streaming version of collectDiagnostics()
  • KT-82519 Automatically recognize the appropriate analysis mode for in-memory file copies based on their content
  • KT-73534 SAM method API
  • KT-82993 Support explicit backing fields in the Analysis API
Fixes
  • KT-79186 KtCompletionExtensionCandidateChecker does not work for extensions when using callable references of a type
  • KT-83759 Analysis API: Mark platform interface APIs with @KaPlatformInterface
  • KT-83921 Extend KaKDocProvider to read Kdoc from KLIB metadata
  • KT-77426 KaFirCompilerFacility uses an arbitrary JVM counterpart for common sources
  • KT-84737 KaCallableSymbol#directlyOverriddenSymbols doesn't work for java overrides of kotlin properties
  • KT-84621 Migrate symbol tests to ManagedTest properly
  • KT-80575 KaFirJavaInteroperabilityComponent#getJavaGetterName should not throw exception on incomplete code
  • KT-84397 KtDefaultAnnotationArgumentReference should return only results with value name
  • KT-84804 buildSubstitutor does not work correctly with Java type parameters
  • KT-84389 Cover references with ABI and documentation checks
  • KT-57042 K2, Analysis API: KaJavaInteroperabilityComponent#callableSymbol returns null for a Java getter implementing Kotlin property
  • KT-80856 Analysis API: analysisContextModule incorrectly determines the module of an original file when used for dangling file context assignment
  • KT-84363 AA, isUsedAsExpression: Unhandled Non-KtExpression parent of KtExpression: class org.jetbrains.kotlin.psi.KtContractEffect
  • KT-70476 Analysis API: "KtDefaultAnnotationArgumentReference.resolveToSymbols" does not work in FIR implementation
  • KT-68499 Split KtDefaultAnnotationArgumentReference on K1 and K2 implementation
  • KT-70521 Analysis API: Impossible to distinguish between 'iterator' operator calls dispatched with imports from objects
  • KT-77669 Context arguments are missed on implicit invoke calls
  • KT-77670 resolveToCall: extensionReceiver is incorrectly chosed due to a conflict with context parameters for an implicit invoke call
  • KT-68633 K2 AA: IAE "Expected class KaClassSymbol instead of class KaFirEnumEntrySymbol" with enum entry initializer
  • KT-83777 Analysis API: The resolution scope of a context module accepts elements from associated dangling files
  • KT-82571 No expected type for overridden property without explicit type
  • KT-83223 Support "Explicit context arguments" in the Analysis API
  • KT-65186 K2: Analysis API: KtExpressionTypeProvider.getExpectedType works incorrectly for the right hand side of assignment expressions
  • KT-76011 KaFirNamedClassSymbol#companionObject doesn't provide generated objects generated by compiled plugins
  • KT-73290 Analysis API: Improve the architecture of content scopes and resolution scopes
Backend. J2KLIB
  • KT-86368 [JKLIB] MetadataJVMModuleDeserializer tries to deserialize all symbols
  • KT-86367 [JKLIB] kotlin.Cloneable built-in class not found
  • KT-84877 [J2KLIB] Remove withKotlinBuiltinsHack present in JKlibIrLinker.kt
  • KT-85846 Tests failing with fake override property missing accessors or backing field
  • KT-85717 IllegalStateException due to already bound symbol
  • KT-86204 [JKlib] Propagate private members from dependecies in the IR tree
Backend. Native. Debug
  • KT-83804 Native: debug information generator converts relative paths to absolute ones
Backend. Wasm
  • KT-83162 K/Wasm: renaming temporary and synthetic variables in the Chrome debugger
  • KT-85008 Develop and publish a demo app using an early version of the component model support
  • KT-76205 K/Wasm: stabilize and turn on incremental compilation by default
  • KT-83728 [Wasm] Invalid Ir type while suspend call with blocked if null comprehansion
  • KT-81637 K/JS/Wasm interop: Inconsistent behavior of is/as operations for JsReference<C> and C
  • KT-65030 K/Wasm: memory allocator for Component Model ABI
  • KT-83607 WasmJS: Production build eliminates 'else if' branch when 'else' is not wrapped with curly braces
  • KT-82803 Kotlin/WASM: Failed to compile the doResume function with if inside catch block
  • KT-83800 [Wasm] Closed world per-module compilation
Compiler
New Features
  • KT-84487 "-Xcollection-literals" compiler flag
  • KT-84072 Collection literals: treat visibility of of during resolve correctly
  • KT-83165 Collection literals: treat Deprecated(HIDDEN) operators of reasonably
  • KT-80500 Collection literals: Analyze ConeCollectionLiteralAtom in cases their expected type is not fully known
  • KT-80491 Implement fallback mechanism for collection literals
  • KT-80490 Implement overload resolution mechanism for collection literals
  • KT-84298 K2: Generate IR for Companion Blocks & Extensions
  • KT-83765 Make -Xsuppress-version-warnings have a diagnostic ID
  • KT-84484 Companion Extensions Analysis & Resolution
  • KT-84199 Implement DontMakeExplicitNullableJavaTypeArgumentsFlexible feature
  • KT-84319 Add JVM target bytecode version 26
  • KT-84297 Serialize & Deserialize Companion Block Declarations & Extensions to/from Metadata
  • KT-84288 Companion Blocks Analysis & Resolution
  • KT-84286 Parse Companion Blocks & Extensions
  • KT-84292 Enforce Companion Blocks & Extensions Language Feature during Resolution
  • KT-84291 Companion Blocks & Extensions Checkers
  • KT-84290 Callable References to Companion Block Declarations & Extensions
  • KT-84287 Build Raw FIR for Companion Blocks & Extensions
  • KT-73256 Implement all meta-target for annotations
  • KT-66344 K1 & K2: False positive WRONG_NUMBER_OF_TYPE_ARGUMENTS in callable reference to inner class member
  • KT-76766 Warning is missing for wrong subclass checking
  • KT-74049 Introduce special override rule to allow overriding T! with T & Any
Performance Improvements
  • KT-84941 Skip linking klibs for generating ObjC headers
  • KT-80367 Reduce memory consumption of DevirtualizationAnalysis
  • KT-84412 iOS release build time dramatically increases with 2.3.20-Beta2 compared to 2.3.10
  • KT-82559 linkDebugTest*X64 tasks are slower for Kotlin 2.3 than for 2.2
  • KT-84095 Improve Unit tail-call optimization to support inline generic functions similar to suspendCoroutine
Fixes
  • KT-77726 Move FirUnusedExpressionChecker to the default checkers list
  • KT-84841 Collection literals: Drop special treatment of when with expected type
  • KT-84732 Collection literals: "Expected FirCollectionLiteralImpl to be resolved" in RHS of equality operator
  • KT-84675 Collection literals: 'Not singleClassifierType superType: TypeVariable(S)' in PCLA
  • KT-84559 @OptIn on collection literal and context-sensitive does not work
  • KT-84547 Collection literals: "Expected expression 'FirCollectionLiteralImpl' to be resolved" in elvis expression
  • KT-80489 Collection literals: experimental version (Frontend)
  • KT-84768 [K/N] switch thread state in org_jetbrains_skia_Canvas__1nDrawPicture to workaround the deadlock
  • KT-52673 Don't report deprecation warning/error on last segments of imports
  • KT-83988 Remove extraneous POP+GETSTATIC Unit for calls of Unit-returning suspend functions
  • KT-77584 Support scripts built from LT in scripting API
  • KT-80113 Consider improving diagnostic messages related to ==/===/is/as
  • KT-85392 Native: concurrency issues in per-file caches
  • KT-83938 Missing Tail call optimization in reference classes returning Unit
  • KT-78432 No-arg constructor should be generated for regular classes with a value class parameter in case of JvmExposeBoxed
  • KT-86130 False positive UNINITIALIZED_ENUM_COMPANION on LV 2.3 and lower
  • KT-84860 False positive UNINITIALIZED_ENUM_COMPANION in enum access with explicit receiver in enum initializer when enum class has a companion
  • KT-86210 Update -Xannotation-default-target CLI parameter doc
  • KT-80590 Drop language version 1.9 for JVM
  • KT-85948 Contracts in 2.4 stdlib is not compatible with 2.3 compiler
  • KT-82123 KDoc: references that goes after markdown blocks don't have links
  • KT-85957 Contract on function is getting discarded if any of effect declarations is unknown
  • KT-84931 Incorrect type nullability in SAM super type in anonymous class-based SAM conversion
  • KT-83766 K2: Wrong sourcePsi is set for SymbolPsiLiteral in SLC for annotation arguments referencing a const val
  • KT-85062 Deprecate language version 2.1
  • KT-79729 Kotlin should warn about orphaned block expressions, e.g. // if () \n { .... }
  • KT-83884 The unused return value checker doesn't report a coercion from reference to Unit
  • KT-85825 Context parameter lambda loses context type when wrapped in nested run blocks
  • KT-37179 false-positive shadowing warning on local and member extension functions in presence of member extension property with invoke operator
  • KT-84366 Invalid name for captured this in bytecode
  • KT-84960 Property contract leaks unsubstituted type parameter in smart cast
  • KT-84281 Standalone typealias-to-object qualifier allows type arguments and has type Unit in this case
  • KT-84280 Standalone Unit qualifier allows type arguments: Unit<Any>
  • KT-84380 Type alias to non-generic class can have (arbitrary number of) type arguments in LHS of ::class
  • KT-84190 Implement basic functionality for returnsResultOf contract
  • KT-83920 False positive "modifier 'value' is not applicable to 'local variable'" with soft keyword in positional destructuring (square bracket) declaration
  • KT-84991 Improve Argument type mismatch diagnostics
  • KT-82216 Sanitize '.kotlin_module' filename
  • KT-85354 checkPsiTypeConsistency: add psi text attachments
  • KT-85479 Improve diagnostic messages for upper bound violations
  • KT-84585 Upper bound violated warning for expansion of type alias in LHS
  • KT-84924 Native: stdlib-cache.lock used by mulitple processes
  • KT-85244 False positive DUPLICATE_BRANCH_CONDITION_IN_WHEN with guard condition
  • KT-85487 Investigate why WrapContinuationForTailCallFunctions does not work in Android Test
  • KT-59633 K2: Implement running AndroidRunner tests with FIR
  • KT-76237 Store File-level annotations in KLIB metadata separately
  • KT-84198 Support multiple embedded .let-like calls with returnsResultOf contract
  • KT-84196 Handle multiple entry/exit points for returnsResultOf functions
  • KT-84195 Handle function references in returnsResultOf
  • KT-85162 Introduce diagnostics to refine numeric types casting
  • KT-80060 False positive REDUNDANT_CALL_OF_CONVERSION_METHOD in case of overloads
  • KT-85289 False-positive smartcast from == with type parameter based variable

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner July 13, 2026 00:31
@renovate
renovate Bot force-pushed the renovate/all branch 4 times, most recently from 99a2f8d to cc45231 Compare July 20, 2026 18:15
@renovate
renovate Bot force-pushed the renovate/all branch 5 times, most recently from 28b7507 to acdbc23 Compare July 22, 2026 06:29
@renovate
renovate Bot force-pushed the renovate/all branch 5 times, most recently from 05427f0 to b0ce7b7 Compare August 3, 2026 12:06
@renovate renovate Bot changed the title fix(deps): update all dependencies Update all dependencies Aug 3, 2026
@renovate
renovate Bot force-pushed the renovate/all branch 3 times, most recently from f6478f4 to 57a107e Compare August 5, 2026 00:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

Type: Maintenance

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants